Warn when the .env holding the API token is readable by others - #137

Merged

willkg merged 8 commits into

mainfrom

env-file-permissions-warning

Sep 7, 2026

Commits on Sep 7, 2026

feat(ui): add SecurityWarn, the one warning --json does not silence
willkg
committed
68c1e3e
feat(client): warn when the .env holding the token is readable by others
willkg
committed
8bd45a6
docs: document the .env permission expectation
willkg
committed
8def856
Revert "feat(ui): add SecurityWarn, the one warning --json does not silence"
willkg
committed
7ba6640
feat(jsonout): carry invocation-level warnings in both documents
willkg
committed
c090226
fix(client): deliver the .env warning to both output modes
willkg
committed
ceeedf6
docs: document the .env permission warning and envelope warnings
willkg
committed
aae9557
Revert "feat(ui): add SecurityWarn, the one warning --json does not silence" (test)
willkg
committed
04ea08c